1. Home
2. All questions
3. Question 122

CISM study material · question 122 of 1000

Monitoring shows the organisation is routinely carrying far more risk than its published tolerance statement allows, with no adverse consequence to date. What does SP 800-39 say this may indicate?

• Security governance
• Risk management

1. That risk tolerance statements are advisory, so no action follows from a gap between them and the risk actually carried
2. That the monitoring is producing false results and should be retuned before any conclusion is drawn from what it reports
3. That the stated risk tolerance may need reconsidering because it does not match operational realities
4. That every activity exceeding tolerance must cease immediately

Challenge yourself on this topic → Study as cards